Small business owners, imagine this: one forgotten SMS MFA code could become the weak link that opens the door to your accounts, unless you switch to passkeys as Microsoft plans to phase out SMS MFA by 2027.
What happened
Microsoft has signaled a shift away from SMS-based multi-factor authentication (MFA) toward phishing-resistant methods, with passkeys playing a central role. In recent coverage and official guidance, the industry is being nudged to adopt passwordless authentication and stronger second factors for both user and admin access. The move aims to reduce the effectiveness of credential-stuffing and phishing attempts that rely on text-message codes or other legacy methods. Details may evolve as Microsoft rolls out changes, but the direction is clear: passkeys and similar phishing-resistant options are becoming the standard for enterprise identity.
Why it matters
Credential stuffing thrives when attackers reuse credentials across services and rely on weak or legacy MFA to clear the path. When admins and domain owners rely on SMS codes or other easily intercepted factors, attackers gain a foothold that can be difficult to detect in real time. Phishing-resistant options like passkeys reduce the chance that a stolen credential can be used to log in, even if an attacker has the password. For small businesses, this means a simpler, stronger defense for high-value accounts and better protection for customer data and corporate assets.
What changes this month matters for your decision: you should start adopting phishing-resistant MFA and plan to move away from SMS-based methods. It also means adding a practical, under-15-minute test to your security routine, so you aren’t left waiting for a big rollout to be finished.
Practical steps you can take now
- Turn on MFA for every account that matters — In the Microsoft 365 admin center, go to Users > Active users > Multi-factor authentication (the right-hand pane) and set MFA to required for all users. This is your first line of defense against credential stuffing.
- Enforce phishing-resistant MFA for admins — Create a Conditional Access policy: Azure portal > Azure Active Directory > Security > Conditional Access > New policy. Assign to All Users, include Admins, apply to All cloud apps, and require MFA with a phishing-resistant method where available. Turn the policy On.
- Move toward passwordless authentication — In the identity provider (Azure AD), enable passwordless options such as FIDO2/WebAuthn passkeys and Windows Hello for Business. Navigate to Security > Authentication methods and enable the passkey-related options for your organization.
- Block legacy authentication — Disable legacy login methods that bypass modern MFA. In Azure AD, use a built-in policy or Conditional Access rule to block legacy authentication for users who still rely on basic or older protocols.
- Run a quick 10-minute account-ownership check — Do this now to reduce risk from compromised domains and admin logins:
- Domain verification: Sign in to your domain registrar and confirm DNS records and ownership details are intact.
- Admin email sanity check: Confirm primary contact emails for admin accounts and ensure they aren’t on compromised lists.
- Sign-in reviews: In your identity portal, check the last 24 hours of sign-ins for admin accounts (Azure AD > Sign-ins) and look for unusual locations or devices.
- Admin roles audit: Review who has 0/1/2 admin roles and remove access for former employees or contractors.
- Dark web/compromise check: Use Have I Been Pwned or equivalent to search for compromised emails associated with your domain, then address any exposure.
- Device checks: Ensure only known devices are connected to admin accounts (Azure AD > Devices).
- Alerts setup: Enable sign-in anomaly alerts so you get a notification on unusual activity.
- Plan for passkeys deployment — Start with high-value accounts (domain admins, finance, IT staff) and enable passkeys where devices support them. Communicate clearly with users about the change to avoid friction and improve adoption.
Final thought
Moving away from SMS MFA isn’t just about following a trend; it’s about strengthening everyday security for you and your customers. If you start with a quick 10-minute check and a few targeted MFA upgrades, you’ll be in a much better position as passkeys become the standard. If you’re unsure where to start, talk to your IT provider about a phased, risk-based rollout that prioritizes admin and domain access.